This is a follow-up to the https://bugs.webkit.org/show_bug.cgi?id=106891 fix, which was not quite correct.
Now we do the array index check according to the ECMAScript 5, section 15.4:
"A property name P (in the form of a String value) is an array index if and only if ToString(ToUint32(P)) is equal to P and ToUint32(P) is not equal to 2^32-1."
Patch to follow.
Created attachment 182949 [details]
Comment on attachment 182949 [details]
Clearing flags on attachment: 182949
Committed r139887: <http://trac.webkit.org/changeset/139887>
All reviewed patches have been landed. Closing bug.